1. Carnegie Mellon University System Modeling and Verification with UCLID System Modeling and Verification with UCLID http://www.cs.cmu.edu/~bryant Randal E. Bryant Contributions by former graduate students: Sanjit Seshia, Shuvendu Lahiri

2. – 2 – Applying Data Abstraction to Hardware Verification Idea Abstract details of data encodings and operations Keep control logic preciseApplications Verify overall correctness of system Assuming individual functional units correctTechnology Use restricted subset of first-order logic Implement efficient decision procedures Multiple methods of performing verification

3. – 3 – Alpha 21264 Microprocessor Microprocessor Report, Oct. 28, 1996 Challenge: System-Level Verification Verification Task Does processor implement its ISA? Why is it Hard? Lots of internal state Complex control logic Complex functionality

4. – 4 – Sources of Complexity State ISA: registers, memory Microarchitectural: caches, buffers, reservation stations Conceptually finite state, but practically unboundedControl Pipelines spread execution across multiple cycles Out-of-order execution modifies processing order Superscalar operation creates parallelism Control logic coordinates everything Resulting behavior matches that of sequential ISA modelFunctionality Arithmetic functions, instruction decoding

5. – 5 – Existing Verification Methods Simulators, equivalence checkers, model checkers, … All Operate at Bit Level RTL model State encoded as words and arrays of words Comprised of bits Most Operate at Cycle or Subcycle Level How each bit of state gets updated System Modeling Languages Abstract time up to transaction level Still view state as collection of bits

6. – 6 – Word-Level Abstraction Data: Abstract details of form & functions Control: Keep at bit level Timing: Keep at cycle level Control Logic Data Path Com. Log. 1 Com. Log. 2

7. – 7 – Data Abstraction #1: Bits → Integers View Data as Symbolic Words Arbitrary integers No assumptions about size or encoding Classic model for reasoning about software Can store in memories & registers x0x0 x1x1 x2x2 x n-1 x 

8. – 8 – Modeling Data Selection If-Then-Else Operation Mulitplexor Allows control-dependent data flow 1010 x y p ITE(p, x, y) 1010 x y 1 x 1010 x y 0 y

9. – 9 – Data Path Com. Log. 1 Com. Log. 2 Abstracting Data Bits Control Logic Data Path Com. Log. 1 Com. Log. 1 ?? What do we do about logic functions?

10. – 10 – Abstraction #2: Uninterpreted Functions For any Block that Transforms or Evaluates Data: Replace with generic, unspecified function Only assumed property is functional consistency: a = x  b = y  f (a, b) = f (x, y) ALUALU f

11. – 11 – Abstracting Functions For Any Block that Transforms Data: Replace by uninterpreted function Ignore detailed functionality Conservative approximation of actual system Data Path Control Logic Com. Log. 1 Com. Log. 1 F1F1 F2F2

12. – 12 – Modeling Data-Dependent Control Model by Uninterpreted Predicate Yields arbitrary Boolean value for each control + data combination Produces same result when arguments match Pipeline & reference model will branch under same conditions Cond Adata Bdata Branch? Branch Logic p

13. – 13 – Abstraction #3: Modeling Memories as Mutable Functions Memory M Modeled as Function M(a): Value at location aInitially Arbitrary state Modeled by uninterpreted function m 0 M a M a m0m0

14. – 14 – Effect of Memory Write Operation Writing Transforms Memory M = Write(M, wa, wd) Reading from updated memory: Address wa will get wd Otherwise get what’s already in M Express with Lambda Notation Notation for defining functions M = a. ITE(a = wa, wd, M(a)) M M a 1010 wd = wa

15. – 15 – Systems with Buffers Modeling Method Mutable function to describe buffer contents Integers to represent head & tail pointers Unbounded Buffer Circular Queue

16. – 16 – Some History of Term-Level Modeling Historically Standard model used for program verification Widely used with theorem-proving approaches to hardware verification E.g, Hunt ’85 Automated Approaches to Hardware Verification Burch & Dill, ’95 Tool for verifying pipelined microprocessors Implemented by form of symbolic simulation Continued application to pipelined processor verification

17. – 17 – UCLID Seshia, Lahiri, Bryant, CAV ‘02 Term-Level Verification System Language for describing systems Inspired by CMU SMV Symbolic simulator Generates integer expressions describing system state after sequence of steps Decision procedure Determines validity of formulas Support for multiple verification techniques Available by Download http://www.cs.cmu.edu/~uclid

18. – 18 – Challenge: Model Generation How to generate term-level model How to guarantee faithfulness to RTL description Comparison of Models RTL Abstracts functional elements from gate-level model Synthesis allows automatic map to gate level Term level Abstracts bit-level data representations to words Abstracts memories to mutable functions No direct connection to synthesizable model

19. – 19 – Generating Term-Level Model Manually Generate from RTL How do we know it is a valid abstraction? Hard to keep consistent with changing RTL Automatically Generate from RTL Andraus & Sakallah, DAC ‘04 Must decide which signals to keep Boolean, which to abstract Confused by bit field extraction primitives of HDL Synthesize RTL from Word-Level Model Difficult to make efficient

20. – 20 – Underlying Logic Existing Approaches to Formal Verification E.g., symbolic model checking State encoded as fixed set of bits Finite state system Amenable to Boolean methods (SAT, BDDs) Our Task State encoded with unbounded data types Arbitrary integers Functions over integers Must use decision procedures Determine validity of formula in some subset of first-order logic Adapt methods historically used by automated theorem provers

21. – 21 – EUF: Equality with Uninterp. Functs Decidable fragment of first order logic Formulas ( F ) Boolean Expressions  F, F 1  F 2, F 1  F 2 Boolean connectives T 1 = T 2 Equation P (T 1, …, T k ) Predicate application Terms ( T ) Integer Expressions ITE(F, T 1, T 2 ) If-then-else Fun (T 1, …, T k ) Function application Functions ( Fun ) Integer  Integer f Uninterpreted function symbol x 1, …, x k. T Function lambda expression Predicates ( P ) Integer  Boolean p Uninterpreted predicate symbol

22. – 22 – UCLID Operation Operation Series of transformations leading to propositional formula Except for lambda expansion, each has polynomial complexity Lambda Expansion Function & Predicate Elimination Finite Instantiation Boolean Satisfiability Symbolic Simulation file.ucl Model + Specification UCLID Formula -free Formula Term Formula Boolean Formula

23. – 23 – Pipeline UCLID Example DLX Pipeline Single-issue, 5-stage pipeline pc pPC fd Valid PC Type Instr de Valid PC Type Instr Arg2 Arg1 mw Valid Dest Data em Branch Valid Type Instr Arg2 Value Target RFMem FetchDecodeExecuteMemory Write Back Integer state Boolean state Function state

24. – 24 – Writing & Reading Register File fd Instr de Arg2 Arg1 mw Valid Dest Data RF Decode Write Back src1 src2

25. – 25 – Writing Register File mw Valid Dest Data RF Write Back init[RF] := rf0; (* Uninterpreted Function *) next[RF] := Lambda(a). case mw_Valid & (a = mw_Dest) : mw_Data; default : RF(a); esac;

26. – 26 – Reading Register File fd Instr de Arg2 Arg1 RF Decode src1 src2 init[de_Arg1] := dea10; (* Initially arbitary *) next[de_Arg1] := next[RF](src1(fd_Instr)); init[de_Arg2] := dea20; (* Initially arbitary *) next[de_Arg2] := next[RF](src2(fd_Instr)); Write-before-read semantics

27. – 27 – Reachable States Verifying Safety Properties State Machine Model State encoded as Booleans, integers, and functions Next state function expresses how updated on each step Prove: System will never reach bad state Reset States Bad States  Present State Next State Inputs (Arbitrary) Reset

28. – 28 – Reachable RnRn R2R2 Bounded Model Checking Repeatedly Perform Image Computations Set of all states reachable by one more state transition Easy to Implement Underapproximation of Reachable State Set But, typically catch most bugs with 8–10 steps Bad States R1R1 Reset States

29. – 29 – RnRn R2R2 True Model Checking Reach Fixed-Point R n = R n+1 = Reachable Impractical for Term-Level Models Many systems never reach fixed point Can keep adding elements to buffer Convergence test undecidable Bad States R1R1 Reset States 

30. – 30 – I Inductive Invariant Checking Key Properties of System that Make it Operate Correctly Formulate as formula I Prove Inductive Holds initially I (s 0 ) Preserved by all state changes I (s)  I (  (i, s)) Reachable States Reset States Bad States 

31. – 31 – An Out-of-order Processor (OOO) Data Dependencies Resolved by Register Renaming Map register ID to instruction in reorder buffer that will generate register value Inorder Retirement Managed by Retirement Buffer FIFO buffer keeping pending instructions in program order Reorder Buffer Fields PC Program memory Reorder Buffer valid value src1valid src1val src1tag src2valid src2val src2tag dest op result bus DECODEDECODE Register Rename Unit valid tag val ALU headtail incr dispatch retire execute result 1 st Operand 2 nd Operand

32. – 32 – Verifying OOO Lahiri, Seshia, & Bryant, FMCAD 2002Goal Show that OOO implements Instruction Set Architecture (ISA) model For all possible execution sequencesChallenge OOO holds partially executed instructions in reorder buffer States of two systems match only when reorder buffer flushed ISA Reg. File PC OOO Reg. File PC Reorder Buffer

33. – 33 – Adding Shadow State McMillan, ‘98 Arons & Pnueli, ‘99 Provides Link Between ISA & OOO Models Additional entries in ROB Do not affect OOO behavior Generated when instruction dispatched Predict values of operands and result From ISA model ISA Reg. File PC OOO Reg. File PC Reorder Buffer

34. – 34 – Invariant Checking Formulas I 1, …, I n I j (s 0 ) holds for any initial state s 0, for 1  j  n I 1 (s)  I 2 (s)  …  I n (s)  I j (s ) for any current state s and successor state s for 1  j  n Invariants for OOO (13) Refinement maps (2) Show relation between ISA and OOO models Shadow state (3) Shadow values correctly predict OOO values State consistency (8) Properties of OOO state that ensure proper operation Overall Correctness Follows by induction on time

35. – 35 – ALU execute Directly Addressable Select particular entry for execution Retrieve result value from executed instruction Access Modes for Reorder Buffer FIFO Insert when dispatch Remove when retire Content Addressable Broadcast result to all entries with matching source tag headtail RetireDispatch result busGlobal Flush all queue entries when instruction at head causes exception All handled by UCLID lambda notation

36. – 36 – OOO Invariants Split into Formulas I 1, …, I n I j (s 0 ) holds for any initial state s 0, for 1  j  n I 1 (s)  I 2 (s)  …  I n (s)  I j (s ) for any current state s and successor state s for 1  j  n Invariants for OOO (13) Refinement maps (2) Show relation between ISA and OOO models State consistency (8) Properties of OOO state that ensure proper operation Added state (3) Shadow values correctly predict OOO values Overall Correctness Follows by induction on time

37. – 37 – State Consistency Invariant Examples Register Renaming invariants (2) Tag in a rename-unit should be in the ROB, and the destination register should match  r.  reg.valid(r)  ( rob.head  reg.tag(r) < rob.tail  rob.dest(reg.tag(r)) = r ) For any entry, the destination should have reg.valid as false and tag should contain this or later instruction  rob t.(  reg.valid(rob.dest(t))  t  reg.tag(rob.dest(t)) < rob.tail)

38. – 38 – Extending the OOO Processor base Executes ALU instructions only exc Handles arithmetic exceptions Must flush reorder buffer exc/br Handles branches Predicts branch & speculatively executes along path exc/br/mem-simp Adds load & store instructions Store commits as instruction retires exc/br/mem Stores held in buffer Can commit later Loads must scan buffer for matching addresses

39. – 39 – Comparative Verification Effort baseexcexc / brexc / br / mem-simp exc / br / mem Total Invariants 1334396771 Manually instantiate 00048 UCLID time 54 s236 s403 s1594 s2200 s Person time 2 days7 days9 days24 days34 days (Person time shown cumulatively)

40. – 40 – “I Just Want a Loaf of Bread” Ingredients Recipe Result

41. – 41 – Cooking with Invariants Ingredients: Predicates Recipe: Invariants Result: Correctness reg.valid(r)  r,t.  reg.valid(r)  reg.tag(r) = t  ( rob.head  reg.tag(r) < rob.tail  rob.dest(t) = r ) rob.head  reg.tag(r) reg.tag(r) = t rob.dest(t) = r

42. – 42 – Automatic Recipe Generation Want Something More Given any set of ingredients Generate best recipe possible Ingredients Recipe Creator Result

43. – 43 – Automatic Predicate Abstraction Graf & Saïdi, CAV ‘97Idea Given set of predicates P 1 (s), …, P k (s) Boolean formulas describing properties of system state View as abstraction mapping: States  {0,1} k Defines abstract FSM over state set {0,1} k Form of abstract interpretation Do reachability analysis similar to symbolic model checkingImplementation Early ones had weak inference capabilities Call theorem prover or decision procedure to test each potential transition Recent ones make better use of symbolic encodings

44. – 44 – Abstract State Space Concrete States Abstract States  P 1 (s), …, P k (s)  s Abstraction Function  t Abstraction Concrete States Abstract States st Concretization Function  Concretization

45. – 45 – Abstract State Machine Transitions in abstract system mirror those in concrete Abstract  Concrete System Abstract System s Concretize  t t s Concrete Transition Abstract Transition

46. – 46 – Generating Concrete Invariant Reach Fixed-Point on Abstract System Termination guaranteed, since finite state Equivalent to Computing Invariant for Concrete System Strongest possible invariant that can be expressed by formula over these predicates RnRn R2R2 R1R1 Reset States AA Abstract System Concretize  Concrete System I Reset States CC

47. – 47 – Systems Verified with Predicate Abstraction Very general models Unbounded processes, buffers, cache lines, … Safety properties only Model PredicatesIterationsCPU Time Out-Of-Order Execution Unit2591,207s German’s Cache Protocol13914s German’s Protocol, unbounded channels 2417427s Bounded Retransmission Buffer22911s Lamport’s Bakery Algorithm3318471s

48. – 48 – Automatic Predicate Discovery Strength of Predicate Abstraction If give it right set of predicates, PA will put them together into invariantWeakness Gets nowhere without right set of predicates Typical failure mode: Generate “true” as invariantChallenges Too many predicates will overwhelm PA engine Our use of quantified invariants precludes counterexample- generated refinement techniques

49. – 49 – Implementation of Predicate Discovery Lahiri & Bryant, CAV ’04 Initially: Extract predicates from verification condition Iterate: Add new predicates by composing next-state formulas With some heuristics thrown inExperience Can automatically generate invariants for real examples ~10X slower than for hand-selected predicates

50. – 50 – Future Prospects Evaluation Important to abstract data & data functions while maintaining details about control Demonstrated ability to verify complex, parameterized systems Model Generation is Weakest Link Big jump from bit-level to term-level Look at intermediate levels of abstraction with bit-vectors Need algorithmic connection between our model and RTL Predicate Abstraction Shows Promise Provides key automation advantage of model checking